What is the CVSS score of EUVD-2026-12327?

EUVD-2026-12327 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Dns 120 are affected by EUVD-2026-12327?

D-Link NAS devices are vulnerable to a high-severity buffer overflow attack that allows authenticated users to take complete control of affected systems.

Is there a public PoC exploit available for EUVD-2026-12327?

Yes, a public proof-of-concept exploit is available for EUVD-2026-12327. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2026-12327?

Within 24 hours: Identify all D-Link NAS devices in your environment and restrict network access to the CGI management interface to authorized administrators only. Within 7 days: Isolate affected NAS devices to a segmented network if they contain sensitive data, review access logs for suspicious activity, and contact D-Link support for patch timelines. Within 30 days: Develop a remediation plan including device replacement, upgrade to patched firmware versions when available, or decommissioning of unsupported models.

Dns 120 EUVD-2026-12327

| CVE-2026-4213 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-03-16 VulDB

Stack Overflow Buffer Overflow D-Link Dns 120 Dns 340l Dns 1200 05 Dns 345 Dns 321 Dns 323 Dns 343 Dns 320 Dns 325 Dns 327l Dns 726 4 Dns 1550 04 Dns 1100 4 Dnr 202l Dnr 326 Dnr 322l Dns 315l Dns 320l Dns 320lw Dns 326

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Mar 16, 2026 - 14:53 vuln.today

Public exploit code

EUVD ID Assigned

Mar 16, 2026 - 05:00 euvd

EUVD-2026-12327

Analysis Generated

Mar 16, 2026 - 05:00 vuln.today

CVE Published

Mar 16, 2026 - 04:02 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability was detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This vulnerability affects the function cgi_myfavorite_del_user/cgi_myfavorite_verify of the file /cgi-bin/gui_mgr.cgi. Performing a manipulation results in stack-based buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used.

AnalysisAI

Stack-based buffer overflow in D-Link DNS storage appliances (DNS-120, DNS-340L, DNS-1200-05 and others) through the /cgi-bin/gui_mgr.cgi endpoint allows remote authenticated attackers to achieve code execution. Public exploit code exists for this vulnerability, and no patch is currently available. Affected firmware versions are dated up to February 5, 2026.

Technical ContextAI

This vulnerability (CWE-121: Stack-based Buffer Overflow) affects the CGI binary gui_mgr.cgi in D-Link NAS devices, specifically in functions that handle user favorite management. The affected products span 20 different D-Link NAS models including DNS-120, DNS-320 series, DNS-340L, DNR series, and enterprise models like DNS-1550-04. All versions up to firmware date 20260205 are vulnerable. Stack buffer overflows occur when input data exceeds allocated buffer space on the stack, potentially overwriting return addresses and enabling code execution.

RemediationAI

No official patches are currently available from D-Link. Immediate mitigations include: 1) Disable remote access to the device management interface, 2) Place devices behind a firewall blocking external access to the CGI interface, 3) Monitor for suspicious authentication attempts and CGI requests to /cgi-bin/gui_mgr.cgi, 4) Consider replacing end-of-life models with supported alternatives. Check D-Link support site for future firmware updates addressing this CVE.